Updated · Volt Ghost team
One host behind six Tuta domains
Every row below came back identical when we queried Cloudflare's resolver on 12 November 2026.
| Tuta domain | MX preference | Points to |
|---|---|---|
tuta.com | 0 | mail.tutanota.de |
tutanota.com | 0 | mail.tutanota.de |
tuta.io | 0 | mail.tutanota.de |
tutanota.de | 0 | mail.tutanota.de |
keemail.me | 0 | mail.tutanota.de |
tutamail.com | 0 | mail.tutanota.de |
mail.tutanota.de returned three IPv4 addresses (185.205.69.211, .213 and .214) and no IPv6. The 185.205.69.0/24 block is announced by AS210909, Tutao GmbH in Germany (per Team Cymru), so Tuta receives on a network registered to itself rather than a cloud provider. The domains' DNS, by contrast, is served by Amazon Route 53 name servers.
How Tuta protects its sending name
| Mechanism | Published at | Content on 12 November |
|---|---|---|
| SPF | apex TXT of all six | v=spf1 include:spf.tutanota.de -all |
| SPF list | spf.tutanota.de TXT | v=spf1 ip4:185.205.69.0/24 ip4:81.3.6.160/28 -all |
| DMARC | _dmarc.tuta.com (same on the other five) | v=DMARC1; p=quarantine; adkim=s |
| MTA-STS | _mta-sts.tuta.com, policy at mta-sts.tuta.com | id=20190723, policy mode: enforce, max_age: 86400 |
| TLS-RPT | _smtp._tls.tuta.com | reports go to [email protected] |
- Short, strict SPF: two address ranges and a hard
-all. Compare WEB.DE and Mail.ru, which end in~all. - Strict DKIM alignment:
adkim=srequires the DKIM signing domain to match the From domain exactly, not just share a parent. The record sets norua, so Tuta does not ask for aggregate DMARC reports. - MTA-STS enforced: like Proton Mail, Tuta tells senders to refuse delivery rather than fall back to unencrypted SMTP.
When Tuta's records matter
Tuta has six address domains, and an allow-list that only knows tutanota.com will miss tuta.com, the domain that matches the current brand name. Matching on the MX host mail.tutanota.de catches all six. If your mail to a Tuta user fails with a TLS error, the enforced MTA-STS policy is the likely reason: your server must present a valid certificate chain when it connects. Run a custom domain through the email host lookup and a Tuta-hosted one shows up as Tuta.
Private is not the same as disposable
People sometimes lump encrypted providers in with throwaway inboxes. They are different things: a Tuta account is meant to last years, while a temporary inbox is meant to vanish after a sign-up. Tuta's own MX host isn't one of the shared servers that throwaway domains point at, so MX-based screening lets it through. See how sites detect disposable email for the full list of signals, or check a domain with the disposable email checker.
Questions
What is the MX record for tuta.com?
tuta.com has one MX record, mail.tutanota.de at priority 0. tutanota.com, tuta.io, tutanota.de, keemail.me and tutamail.com publish the same record.
Does Tuta enforce MTA-STS?
Yes. On 12 November 2026 the tuta.com policy file said mode: enforce with mail.tutanota.de as the only allowed host, so senders that support MTA-STS must deliver over verified TLS or not at all.
Why does Tuta's MX use priority 0?
Priority only matters relative to other MX records. With a single record, 0 and 10 behave the same; 0 is simply the lowest possible value.
Is Tuta a temporary or burner email service?
No. Tuta, formerly Tutanota, offers long-term encrypted mailboxes. tuta.com, tutanota.com and its other four domains do not appear on the community throwaway-domain list we check against.
